CVE-2024-53178

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: Don't leak cfid when reconnect races with open_cached_dir

open_cached_dir() may either race with the tcon reconnection even before

compound_send_recv() or directly trigger a reconnection via

SMB2_open_init() or SMB_query_info_init().

The reconnection process invokes invalidate_all_cached_dirs() via

cifs_mark_open_files_invalid(), which removes all cfids from the

cfids->entries list but doesn't drop a ref if has_lease isn't true. This

results in the currently-being-constructed cfid not being on the list,

but still having a refcount of 2. It leaks if returned from

open_cached_dir().

Fix this by setting cfid->has_lease when the ref is actually taken; the

cfid will not be used by other threads until it has a valid time.

Addresses these kmemleaks:

unreferenced object 0xffff8881090c4000 (size 1024):

comm "bash", pid 1860, jiffies 4295126592

hex dump (first 32 bytes):

00 01 00 00 00 00 ad de 22 01 00 00 00

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References